UBUNTU-CVE-2024-27064

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Fix a memory leak in nftablesupdchain If nftnetdevregisterhooks fails, the memory associated with nftstats is not freed, causing a memory leak. This patch fixes it by moving nftstatsalloc down after...

UBUNTU-CVE-2024-27027

In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpllxarefdel for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU: 5 PID: 2212 at drivers/dpll/dpllcore.c:143...

UBUNTU-CVE-2024-27039

In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devmkfree 'pclk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration. If a clkregister call fails, 'pclk' may...

CVE-2024-27027

According to the connected advisories, CVE-2024-27027 affects the Linux kernel DPLL driver where multiple registrations of the same pin on a DPLL device could leave stale list entries if the reference count was not zero. The root cause was that unregistration and freeing of the registration were ...

kernel: Linux kernel: Denial of Service in ARM FF-A due to duplicate device names during logical partition registration.

A flaw was found in the Linux kernel's ARM Firmware Framework for Arm FF-A component. This vulnerability occurs when the system attempts to register multiple logical partitions within a physical partition. Due to an issue in how device names are generated, duplicate names can be created, preventi...

kernel: wifi: fix registration of 6Ghz-only phy without the full channel range

A flaw was found in the Linux kernel ath11k Wi-Fi driver’s channel range validation logic. When registering a 6 GHz-only physical device whose board data does not allow a specific 7.115 GHz channel, the driver incorrectly handles the channel range, causing the phy to fail registration. This...

SUSE CVE-2022-48661

In the Linux kernel, the following vulnerability has been resolved: gpio: mockup: Fix potential resource leakage when register a chip If creation of software node fails, the locally allocated string array is left unfreed. Free it on error path...

WordPress AJAX Login and Registration modal popup + inline form plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin AJAX Login and Registration modal popup + inline form versions = 2.23...

CVE-2024-4310

Cross-site Scripting XSS vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the page, resulting in a session takeover...

CVE-2024-4310

HubBank 1.0.2 is affected by a Cross-site Scripting (XSS) vulnerability in registration and profile forms due to insufficient input filtering/escaping. An attacker can deliver a crafted JavaScript payload that executes when an authenticated user loads the page, enabling session takeover. Affected...

CVE-2024-4310 Cross-site Scripting (XSS) vulnerability in HubBank

Cross-site Scripting XSS vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the page, resulting in a session takeover...

HubBank 跨站脚本漏洞

HubBank is an app from HubBank, Inc. A cross-site scripting vulnerability exists in HubBank version 1.0.2, which stems from the lack of effective filtering and escaping of user-supplied data on registration and profile forms, and can be exploited by an attacker to execute arbitrary web script or...

PT-2024-30296 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is a Cross-site Scripting XSS vulnerability that allows an attacker to send a specially crafted JavaScript payload to registration and profile forms. This payload can be triggered when any...

WordPress AJAX Login and Registration modal popup + inline form Plugin <= 2.23 is vulnerable to Cross Site Scripting (XSS)

Software AJAX Login and Registration modal popup + inline form Type Plugin Vulnerable versions = 2.23 Fixed in 2.24 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33918 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID ea1aeec00d87...

UBUNTU-CVE-2022-48660

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Set lineeventstate::irq after IRQ register successfully When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below: Cal...

UBUNTU-CVE-2022-48661

In the Linux kernel, the following vulnerability has been resolved: gpio: mockup: Fix potential resource leakage when register a chip If creation of software node fails, the locally allocated string array is left unfreed. Free it on error path...

CVE-2022-48660 gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully

In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Set lineeventstate::irq after IRQ register successfully When running gpio test on nxp-ls1028 platform with below command gpiomon --num-events=3 --rising-edge gpiochip1 25 There will be a warning trace as below: Cal...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a resource leak when registering a chip...

Tutor LMS < 2.7.0 - Missing Authorization to Unauthenticated Limited Options Update

Description The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers ...

CVE-2023-6717

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...